19 ms·

This is a bigger issue than 'credit agencies have poor security'. This is an issue of 'standard authentication in the US is negligently weak'. Knowledge of a S

by rocqua 7y ago

This is a bigger issue than 'credit agencies have poor security'. This is an issue of 'standard authentication in the US is negligently weak'. Knowledge of a SSN and other public information should never be enough to authenticate any person. That means no credit issued based on that, no tax returns filed or viewed based on that, no checks sent based on that. The solution is not better security with credit companies. The solution is some form of actual authentication. Preferably done by an organization dedicated to that (public would be best, private could work); not outsourced to organizations that are mostly geared towards determining credit worthiness. For the public system, assign to every participant a true unique identifier, rather than the SSN which explicitly states should not be used as such. For those citizens that do not want to register in this way, allow for physical authentication at physical locations. In Europe this is far less of an issue since our population registration is a lot more comprehensive.

souterrain 7y ago
To this point: does “identity theft” really exist, or is this simply a reframing of banks, etc., completely failing at authentication?
- ethbro 7y ago
  Point. Identity hacking would be more accurate. In that the attacker is creatively operating the system, rather than really possessing magic knowledge.
- pault 7y ago
  The concept of "identity theft" (i.e. the hacker stole your identity vs. the hacker used false credentials to steal from the bank) is probably the single greatest feat of social engineering of our times.
- 3JPLW 7y ago
  Identity theft is an amazing PR term, not-so-subtly shifting blame onto the individual whose identity was fraudulently used. * The PII wasn't stolen from me, it was negligently exposed by services I contract with (and pay!) and others that I have no formal relationship with (like Equifax). * It wasn't defrauding me, it was defrauding services I contract with (and others) who failed to verify my identity. And yet somehow I'm obligated to do the cleanup myself.
  - tryptophan 7y ago
    Yup. The quickest way to stop these sorts of things from happening is to make the banks responsible for accepting/using stolen information(ie facilitating identify theft). For some odd reason, its the person's responsibility now that the bank used fraudulent information.
- keiru 7y ago
  Today, you are not you, you are your data, a persona. And you are somehow responsible for it or anything that casts a similar shadow.
unclesams-uncle 7y ago
The Belgians have this tool called "itsme" which acts as authentication manager/digital signature tool with authorized partners. After validating your ID, you can use the app to do 2FA with most major services in the country, including almost every bank and financial institution. https://www.itsme.be/en/ https://www.itsme.be/en/ A program like this could go a long way in the US to help cut down on the issue you describe.
- amitparikh 7y ago
  Thanks. Another example is the Dutch DigID: https://www.digid.nl/en/about-digid/ https://www.digid.nl/en/about-digid/
- scient 7y ago
  You should look into Estonian ID card program. Its exactly what should be done.
SamuelAdams 7y ago
I agree, SSN's are a poor form of authentication. What's missing from these conversations is realistic approaches to fixing it. It's a lot like healthcare: plenty of people want to get rid of Obamacare, but they fail to explain what will replace it. > For the public system, assign to every participant a true unique identifier, rather than the SSN which explicitly states should not be used as such. This will work for a time, but what happens when the next breach occurs? How do people renew their UUID's? Expire compromised ones? > For those citizens that do not want to register in this way, allow for physical authentication at physical locations. Physical authentication probably means fingerprints, face data, correct? These are already compromised. Worse yet, they cannot be changed. CCTV cameras are everywhere, and getting better resolution each day. Face authentication can be easily duplicated - some of the early versions of FaceID (by Apple) were broken by 3-D printing a mask [2]. Furthermore, some organizations are already compiling a list of "face data" that can be used to fool sensors and other biometric tools. By the time "face readers" are widespread, hackers will already have large pools of face data to use to hack into these systems. There are other cases where fingerprints have been printed using a 3-D printer and have broken security of mobile smartphones [1]. What's to say whatever government issued terminal won't be broken in a similar way? Furthermore, it's not easy to expect people to guard their fingerprints: every glass they drink at a restaurant will have their fingerprints. I don't expect to shed my SSN whenever I order a pint at my favorite pub. [1]: https://www.theverge.com/2019/4/7/18299366/samsung-galaxy-s10-fingerprint-sensor-fooled-3d-printed-fingerprint https://www.theverge.com/2019/4/7/18299366/samsung-galaxy-s1... [2]: https://www.wired.co.uk/article/hackers-trick-apple-iphone-x-face-id-3d-mask-security https://www.wired.co.uk/article/hackers-trick-apple-iphone-x...
- sangnoir 7y ago
  > This will work for a time, but what happens when the next breach occurs? The UUID shouldn't be assumed to be private information - authentication should be built around the assumption that this identifier is a public identifier - like a name, but guaranteed to be unique. > Physical authentication probably means fingerprints, face data, correct? These are already compromised. Worse yet, they cannot be changed. Even if those are compromised, that doesn't mean it has to be easy to impersonate you. The solution may be low-tech - you may have to physically present yourself to a human who assesses if you are indeed who you say you are before opening an account. The higher tech solution physical authentication might require something akin to chip-and-pin or a (revocable) token generator a la Ubikey
arbuge 7y ago
> For the public system, assign to every participant a true unique identifier, rather than the SSN which explicitly states should not be used as such. How do you make this proposed new unique identifier more secure than the (admittedly very unsecure) SSNs?
- rocqua 7y ago
  Only use it as an identifier, not as a part of authentication. The issues with using an SSN as a identifier (username) are: 1) Explicitly not meant as an identifier 2) Not unique If not for 2, then the SSN could simply be repurposed to be this identifier.
Allower 7y ago
How do we change it? Everytime I bring this up to my bank et al I get blank stares and random stuttering.
taude 7y ago
I really wish the mainstream media could pick up more on this, and instead of framing all these breaches and news as Identity Theft, reframe them to the credit companies offloading burden of risk onto consumers. Most people don't even have the context of what is really going on with this. we all should really assume that our SSN & PII is splattered across hundreds if not thousands of databases all in a various state of protection, and not be held liable for the lazy credit companies who's business is based on not making it hard to get instant credit for all those emotional purchases...
mindslight 7y ago
In the US especially, there is a very good reason to oppose any such measure - there is no political will to implement restrictions on how private companies could use that system. The setup for these breaches is entirely due to companies being able to require your SSN for whatever purpose, and indefinitely store it basically however they'd like. Either the government should have never assigned a mandatory unique identifier to every individual, or there should have been strict laws about what purposes it could be requested/used for, how it could be stored, and steep statutory liability for screwing those up. But the political attitude in the US is to have the government do the bare minimum and private companies will take up the charge. However for many subjects the resulting mix is the worst of both worlds - given the tiniest hook into governmental power, the private sector eagerly implements totalitarian solutions for which there is no opting out. Presently, the naive legal mandates of SSN's, driver's license numbers, and license plates are being heavily abused to enable pervasive corporate surveillance. These existing identifiers already make too good of keys for cross-linking every other ill-gotten datum on a person. The main thing that keeps every single business from demanding these identifiers is people's ambiguous worry of just handing them out, due to their technical shortcomings. Imagine going to a grocery store and having to present your national electronic ID to get the sale prices, with no alternative. previously: https://news.ycombinator.com/item?id=19880374 https://news.ycombinator.com/item?id=19880374

by rocqua 7y ago

souterrain 7y ago

To this point: does “identity theft” really exist, or is this simply a reframing of banks, etc., completely failing at authentication?

ethbro 7y ago
Point. Identity hacking would be more accurate. In that the attacker is creatively operating the system, rather than really possessing magic knowledge.
pault 7y ago
The concept of "identity theft" (i.e. the hacker stole your identity vs. the hacker used false credentials to steal from the bank) is probably the single greatest feat of social engineering of our times.
3JPLW 7y ago
Identity theft is an amazing PR term, not-so-subtly shifting blame onto the individual whose identity was fraudulently used. * The PII wasn't stolen from me, it was negligently exposed by services I contract with (and pay!) and others that I have no formal relationship with (like Equifax). * It wasn't defrauding me, it was defrauding services I contract with (and others) who failed to verify my identity. And yet somehow I'm obligated to do the cleanup myself.
- tryptophan 7y ago
  Yup. The quickest way to stop these sorts of things from happening is to make the banks responsible for accepting/using stolen information(ie facilitating identify theft). For some odd reason, its the person's responsibility now that the bank used fraudulent information.
keiru 7y ago
Today, you are not you, you are your data, a persona. And you are somehow responsible for it or anything that casts a similar shadow.

unclesams-uncle 7y ago

The Belgians have this tool called "itsme" which acts as authentication manager/digital signature tool with authorized partners. After validating your ID, you can use the app to do 2FA with most major services in the country, including almost every bank and financial institution. https://www.itsme.be/en/ https://www.itsme.be/en/ A program like this could go a long way in the US to help cut down on the issue you describe.

amitparikh 7y ago
Thanks. Another example is the Dutch DigID: https://www.digid.nl/en/about-digid/ https://www.digid.nl/en/about-digid/
scient 7y ago
You should look into Estonian ID card program. Its exactly what should be done.

SamuelAdams 7y ago

I agree, SSN's are a poor form of authentication. What's missing from these conversations is realistic approaches to fixing it. It's a lot like healthcare: plenty of people want to get rid of Obamacare, but they fail to explain what will replace it. > For the public system, assign to every participant a true unique identifier, rather than the SSN which explicitly states should not be used as such. This will work for a time, but what happens when the next breach occurs? How do people renew their UUID's? Expire compromised ones? > For those citizens that do not want to register in this way, allow for physical authentication at physical locations. Physical authentication probably means fingerprints, face data, correct? These are already compromised. Worse yet, they cannot be changed. CCTV cameras are everywhere, and getting better resolution each day. Face authentication can be easily duplicated - some of the early versions of FaceID (by Apple) were broken by 3-D printing a mask [2]. Furthermore, some organizations are already compiling a list of "face data" that can be used to fool sensors and other biometric tools. By the time "face readers" are widespread, hackers will already have large pools of face data to use to hack into these systems. There are other cases where fingerprints have been printed using a 3-D printer and have broken security of mobile smartphones [1]. What's to say whatever government issued terminal won't be broken in a similar way? Furthermore, it's not easy to expect people to guard their fingerprints: every glass they drink at a restaurant will have their fingerprints. I don't expect to shed my SSN whenever I order a pint at my favorite pub. [1]: https://www.theverge.com/2019/4/7/18299366/samsung-galaxy-s10-fingerprint-sensor-fooled-3d-printed-fingerprint https://www.theverge.com/2019/4/7/18299366/samsung-galaxy-s1... [2]: https://www.wired.co.uk/article/hackers-trick-apple-iphone-x-face-id-3d-mask-security https://www.wired.co.uk/article/hackers-trick-apple-iphone-x...

sangnoir 7y ago
> This will work for a time, but what happens when the next breach occurs? The UUID shouldn't be assumed to be private information - authentication should be built around the assumption that this identifier is a public identifier - like a name, but guaranteed to be unique. > Physical authentication probably means fingerprints, face data, correct? These are already compromised. Worse yet, they cannot be changed. Even if those are compromised, that doesn't mean it has to be easy to impersonate you. The solution may be low-tech - you may have to physically present yourself to a human who assesses if you are indeed who you say you are before opening an account. The higher tech solution physical authentication might require something akin to chip-and-pin or a (revocable) token generator a la Ubikey

arbuge 7y ago

> For the public system, assign to every participant a true unique identifier, rather than the SSN which explicitly states should not be used as such. How do you make this proposed new unique identifier more secure than the (admittedly very unsecure) SSNs?

rocqua 7y ago
Only use it as an identifier, not as a part of authentication. The issues with using an SSN as a identifier (username) are: 1) Explicitly not meant as an identifier 2) Not unique If not for 2, then the SSN could simply be repurposed to be this identifier.

Allower 7y ago

How do we change it? Everytime I bring this up to my bank et al I get blank stares and random stuttering.

taude 7y ago

I really wish the mainstream media could pick up more on this, and instead of framing all these breaches and news as Identity Theft, reframe them to the credit companies offloading burden of risk onto consumers. Most people don't even have the context of what is really going on with this. we all should really assume that our SSN & PII is splattered across hundreds if not thousands of databases all in a various state of protection, and not be held liable for the lazy credit companies who's business is based on not making it hard to get instant credit for all those emotional purchases...

mindslight 7y ago

In the US especially, there is a very good reason to oppose any such measure - there is no political will to implement restrictions on how private companies could use that system. The setup for these breaches is entirely due to companies being able to require your SSN for whatever purpose, and indefinitely store it basically however they'd like. Either the government should have never assigned a mandatory unique identifier to every individual, or there should have been strict laws about what purposes it could be requested/used for, how it could be stored, and steep statutory liability for screwing those up. But the political attitude in the US is to have the government do the bare minimum and private companies will take up the charge. However for many subjects the resulting mix is the worst of both worlds - given the tiniest hook into governmental power, the private sector eagerly implements totalitarian solutions for which there is no opting out. Presently, the naive legal mandates of SSN's, driver's license numbers, and license plates are being heavily abused to enable pervasive corporate surveillance. These existing identifiers already make too good of keys for cross-linking every other ill-gotten datum on a person. The main thing that keeps every single business from demanding these identifiers is people's ambiguous worry of just handing them out, due to their technical shortcomings. Imagine going to a grocery store and having to present your national electronic ID to get the sale prices, with no alternative. previously: https://news.ycombinator.com/item?id=19880374 https://news.ycombinator.com/item?id=19880374